TRAFFIC MANAGEMENT

1
Traffic management

Objectives
At the end of the module the student is able to:
• Explain the mobility concept (handover, location update, paging)
• List the three numbers in the authentication triplet and explain the use for
each of them
• List at least four teleservices
• List and explain the operation of at least four supplementary services
offered by GSM networks

2
“Registration” of a “subscriber”

3
“Updating subscriber data”

Embassy

4
Provision of “services”

5
Turning on a mobile phone

BTS

6
GSM databases (1)

Subscriber Identity Module (SIM)

Information in a SIM card:
– Security handling information
– Subscriber identity
– Temporary network information
– Access rights (Nat., Intl.)
– Preferred networks
– Prohibited networks

7
GSM databases (2)

Home Location register (HLR)

• Permanent data
• Regular update of HLR
subscriber’s current VLR

Visitor Location register (VLR)

• Temporary data
• Kept as long as subscriber
is within its coverage area
• Updated from the HLR
VLR
• Always associated with a
Mobile Services Switching
Centre (MSC)
MSC

8
Databases in a GSM network

GSM network

HLR

VLR
MSC

SIM

9
Location update

• The Mobile Station monitors the information broadcast by the

network.

• The Mobile Station stores the current location area identity in the SIM
card.

• The Mobile Station continues to monitor the broadcast information.

• If the location area identity being broadcast by the network is other

than the one stored in the SIM, the Mobile Station starts the location
update procedure.

10
Elements involved in a location update

HLR

VLR VLR
MSC
MSC (new)
(old)
Location
Update

Mobile moves SIM

11
Location update procedure - first time

MS BSS MSC VLR HLR

LOCATION UPDATE REQUEST

REQUEST SUBSCRIBER ID

SEND SUBSCRIBER ID

REQUEST AUTHENTICATION INFO

SEND AUTHENTICATION INFO

AUTHENTICATION

AUTHENTICATION RESPONSE
LOCATION UPDATE MESSAGE

LOCATION UPDATE OK ACKNOWLEDGEMENT, SUBSCRIBER INFORMATION

ACKNOWLEDGEMENT

12
Call set-up in a GSM network: PSTN originated call (1)

MSISDN PSTN

The dialled number is Mobile Subscriber International ISDN Number (MSISDN)

MSISDN = CC + NDC + SN
CC: Country Code
NDC: National Destination Code
SN: Subscriber Number
358505527268
358 = Country Code (Finland)
50 = National Destination code (Radiolinja)
5527268 = Subscriber Number

13
Call set-up in a GSM network (2)

• The PSTN routes the call to a GSM

network
HLR • The MSC connected to the PSTN is
known as the Gateway MSC
(GMSC)
GMSC • The GMSC analyses the received
MSISDN
PSTN MSISDN • The only database that knows where
VLR
a GSM subscriber is at any given
moment is the HLR
• The GMSC requests the HLR for some
routing information to know where
GSM to route the call
Network
• This procedure is known as HLR
Enquiry

14
Call set-up in a GSM network (3)
The HLR looks up its
database.
HLR database contents:
MSISDN: 358505527268
IMSI: 244052200002345
VLR address: xyz
Subscriber data: Services....
IMSI = MCC + MNC + MSIN
IMSI: International Mobile Subscriber
Identity
MCC: Mobile Country Code (3 digits)
MNC: Mobile Network Code (2 digits)
MSIN: Mobile Subscriber Identity
Number (max 10 digits)
244052200002345
244: MCC of Finland
05: MNC of Radiolinja
2200002345: MSIN
15
Call set-up in a GSM network (4)

HLR

Gateway
MSC Target
MSC
PSTN VLR
VLR

GSM
Network

Elements involved in a call set-up inside the GSM network

16
Call set-up in a GSM network (5)

• The HLR takes the VLR address of the

subscriber from its database.
• The HLR sends a routing information
HLR request message to the target
MSC/VLR.
Routing • The target MSC/VLR allocates a
information Mobile Subscriber Roaming
request Number (MSRN) for this call.
message
Gateway MSC MSRN = CC + NDC + SN
The format of the MSRN is the same
as the MSISDN. The term SN in the
VLR MSISDN points to a database location
in the HLR; in case of MSRN it points a
database location in the VLR.
VLR
The MSRN also has sufficient
information to enable the GMSC to
route the call to the target MSC.

Target MSC

17
Call set-up in a GSM network (6)

• The target MSC forwards the MSRN to

HLR the HLR.
• The HLR forwards this to the
originating MSC.
• The originating MSC analyses the
358 50 456456 MSRN No.
to HLR MSRN.
• The “telephone number” type of
Gateway MSC
format enables the call to be routed to
the destination MSC, wherever in the
VLR
world it may be.

VLR

Target MSC

18
Location areas

• The MSC/VLR area is divided into

small areas called Location areas.
• A subscriber can move within this
Reception Restaurant Bar Pool
area without having to make a
generic location update (explained
later).
• The maximum size of an LA can be
one MSC area and the minimum size
is one cell.
• Paging is done in all cells of the LA
where the subscriber is currently
located.
LA 5 • LAI = MCC + MNC + LAC
LAI = Location Area Identity
LA 1 MCC = Mobile Country Code
LA 4 MNC = Mobile Network Code
M SC VL R LAC = Location Area Code

LA 2
LA 3

19
Paging process

Location Area

Paging Paging

BTS BTS

Mobile responds
to paging Paging

BTS

20
Simplified steps of a call set-up in a GSM network

A- GMSC HLR MSC/VLR

PSTN
Subscriber

CALL SETUP (MSISDN)

ANALYSE NUMBER
CALL SETUP (MSISDN)

MSISDN

IMSI

MSRN
MSRN

CALL SETUP (MSRN)

PAGING

21
Mobile originated call

• The Mobile Station user dials a number.

• The serving MSC analyses the calling subscriber data.
Depending on the subscriber data, the MSC will:
– authorise or deny the use of the network
– activate the requested service
– route the call.
• If the dialled number is an MSISDN of another Mobile Station
belonging to the same network, an HLR enquiry is performed
to obtain the MSRN.
– The procedure is same as that of a PSTN originating call.
• If the dialled number is any other number, the call is routed
out to the Public Switched Telephone Network (PSTN) via the
Gateway MSC.

22
Simplified steps of a mobile originated call

EXC GMSC HLR MSC VLR BSS MS

1. channel assignment

2. security procedures

3. call setup

4. check services etc.

5. all ok

6. call is proceeding

7. traffic channel allocated

8. set up the call

9. call set up complete

10. alert

11. B answers

23
Types of location updates

Power On
– Also known as “IMSI Attach” and
“Location Registration”.
– Done every time a Mobile Station
is switched on.
Generic
– Done every time a Mobile Station
changes a location area. M SC VL R

Periodic LA 2
– Performed after a preset timer LA 1
expires, since the last transaction
with the network.
– Timer value is dependent on the
network operator.
The Mobile Station starts the procedure.

24
Generic location update procedure

MS BSS MSC VLRnew VLRold HLR

1. channel assignment

2. location update request

3. request subscriber identity

4. send subscriber identity and security information

5. security procedures

6. update HLR

7. acknowledgement, subscriber information

8. cancel old location

9. location cancelling accepted

10. location update acknowledgement, new TMSI

11. TMSI acknowledgement

25
Handovers

Handover due to traffic reasons

– When the capacity of a cell nears its maximum, mobile stations in the
periphery of the cell may be handed over to neighbouring cell with lower
traffic load.
– The MSC starts the procedure.

Handover due to signal quality and strength

– When a mobile subscriber is moving during a call, he may travel from one
cell to another.
– Frequency resources of previous cells can not be used any more.
– The mobile station is handed over to the new cell.
– The BSC controlling the current cell makes the decision to perform a
handover.
– There are four types of these handovers.

26
Intra cell - Intra BSC handover

Air A

BSC TC
BTS

l
h anne
O ld C

Ch annel
N ew

27
Inter cell - Intra BSC handover

Air A

BTS BSC TC

BTS

Old Cell / BTS New Cell / BTS

28
Inter cell - Inter BSC handover

New Cell / BTS

Air A

BSC TC
BTS

MSC VLR

BSC TC
BTS

Old Cell / BTS

29
Inter MSC handover (1)

New Cell / BTS

Air A

BSC TC
BTS MSC VLR

BSC TC
BTS MSC VLR

Old Cell / BTS

30
Inter MSC handover (2)

• The source MSC is known as the Anchor MSC.

• The call is routed from the source MSC to the target MSC.
• A routing number is needed to route a call from one MSC to
another MSC.
• The source MSC requests the target MSC for a Handover Number
(HON). The target MSC allocates one and gives it to the source
MSC.
• The format is the same as the MSRN.

HON = CC + NDC + SN

31
Inter MSC handover (3)

MS BSSold MSCold MSCnew BSSnew MS (after HO)

1. measurement reports
2. handover required

3. request HON
4. request for radio resources

5. radio resources reserved

6. provide HON and target cell info

7. set up speech connection (HON)

8. handover command
9. handover complete

10. handover complete

11. connect

12. release old connections

32
Charging

• Installation fee

• Renting of the service

• Use of the network

What to charge? Different charging packages.

33
Factors affecting the price of a call

• Type of basic service

• Duration of the call
• Time of the call
• Destination of the call
• Origin of the call
• Use of networks
• Type of supplementary service
• Use of radio resources
• Roaming leg

34
Whom to charge?

Where is the
called party?

Bill to subscriber

Billing
BSC
BC
Transfer of
Charging data PSTN
MSC HLR
MSC BC
PLMN 2 Path of
Charging the call
PLMN 1

Calling Party

35
Collection of charging data

• Charging depends on many factors.

• The MSC that handles the call collects all information which could be the
basis for charging.
• This collected information call is stored in Charging Data Records (Toll
Tickets).

BSC
GMSC

PSTN

BTS

HLR

Charging Data Record

36
Elements involved in call handling

HLR

GMSC

BSC
BTS
PSTN

BSC
MSC

37
Transfer of charging data

• Charging records are stored in the MSC where they are

collected.
• When sufficient charging records have been collected they are
transferred in one bulk to the Billing Centre.
• The Billing Centre is responsible for producing the bills for the
subscribers based on the information contained in the
Charging Record.

HLR

GMSC

MSC
BTS
PSTN BSC

X.25 or
Ethernet

Billing Centre (BC)

38
Security issues

• Authentication
– Verification of the subscriber.
• Ciphering
– Encryption of user speech in the Air Interface.
• IMEI checking
– Verification of the Mobile Equipment by checking the
validity of the International Mobile Equipment Identity
(IMEI).
• User confidentiality
– Avoidance of the broadcast of user’s IMSI in the Air
Interface.

39
Authentication

• Each subscriber has an identity key, Ki, stored in the

Authentication Centre (AC) and the SIM card.
• Comparison of Ki without broadcasting it in the Air Interface.
• Authentication always performed by the VLR before call
establishment and location update.

Air A
SIM
card AC

MSC
* IMSI VLR * IMSI

* Ki * Ki

40
Security algorithms

• Need to check Ki without transmitting it in the air

– Use of one-way algorithm, A3, to produce a Signed Response (SRES), by using a
Random Number (RAND) and Ki as inputs.
– SRES is calculated in the AC and SIM, and compared in the VLR for authentication.
• Need a cipherkey, Kc to encrypt user speech.
– K is generated using the algorithm A8.
c

• Actual encryption of user speech is done using Kc and digitised

speech as inputs to the encryption algorithm A5.
– Performed between the Base Transceiver Station (BTS) and the Mobile Equipment
(ME).

41
Location of security algorithms

A ir A
AC
A3 A8

BSC TC
BTS MSC
VLR

ME + SIM A5

A5 A3 A8

42
Authentication triplet

• Authentication verification is done in the VLR serving the

subscriber.
• The VLR can be external to the subscriber’s home network (in
case of roaming).
• Excessive signalling is required to transfer the SRES to the VLR
every time authentication is needed.
• The AC generates a number of SRESs, and transfers them along
with the corresponding RAND and cipher key Kc to the serving
VLR.
• The VLR uses the triplets to verify the subscriber.
• When the number of triplets reaches below a certain threshold,
new triplets are requested from the AC.

43
Authentication triplet generation

Random number
Ki
generator

AC A3 A8

RAND SRES Kc

Authentication triplet

RAND SRES Kc
VLR
Authentication triplet

44
Authentication procedure

Authentication Triplet

VLR RAND
SRES Kc

Comparison

BSC

BTS Kc

MS

RAND

SIM
A3 SRES

Ki A8 Kc

45
Speech encryption

SPEECH/DATA

BTS A5

Kc

TDMA

A5

ENCRYPTED
SPEECH/DATA

A5

Kc

TDMA

A5

SPEECH/DATA

46
IMEI checking

• The validity of a mobile equipment may be checked to ensure

its proper operation and as prevention against stolen phones.
• The Equipment Identity Register (EIR), which is implemented as
part of the HLR, can store “black listed” IMEI numbers.
• The mobile equipment sends its IMEI before a transaction with
the network
• The MSC can request the EIR to see if the received IMEI is
“black listed”
• If it is, the MSC can stop the call set-up
• An operator can set the MSC to check the IMEI of a mobile
equipment at times other than during call set-up as well.

47
User confidentiality

• IMSI is a confidential identity of the subscriber.

• After a successful first time location update, a mobile subscriber is
allocated a Temporary Mobile Subscriber Identity (TMSI).
• The next time a transaction between the GSM network and the MS is
initiated, the subscriber is identified by the use of TMSI.
• TMSI is reallocated after every successful authentication verification.
• The format of TMSI is operator dependent. It is a 32 bit binary
number.
• Additionally, there is the provision of a Personal Identification
Number (PIN) code in the SIM card, which, if enabled, must be
entered before an MS can be used.

48
Services

What are services?

– A subscriber action that uses the facilities of the GSM network.
Classification of services
– Teleservices
– Provide full communication capacity by Services
means of terminals and network functions.
OSI layers 1 to 7.
– Bearer services
– Provide the capability for transmitting
signals between the GSM network Basic Supplementary
access point and an appropriate services services
access point in the terminating
network. OSI layers 1 to 3.

Teleservices Bearer
services

49
Teleservices

Service Description GSM Characteristics

Specification
Code
Speech (Telephony) T11 The most important service for mobile
systems, normal speech service,
including emergency calls.
Speech (Emergency Calls) T12 Emergency calls are possible
automatically.
Short Message Service (Mobile T21 For the reception of Short messages.
terminated)
Short Message Service (Mobile T22 For sending a short message to
originated) another GSM subscriber.
Short Message Service (cell T23 For sending short messages to more
broadcast) than one receiver simultaneously within
a given cell.
Group 3 Facsimile transmission T61 Not supported by NOKIA.
(with alternate speech)
Automatic Group 3 Facsimile T62 For sending and receiving facsimile
transmission messages.

50
Short Message Service (MO, MT)

A ir A

MSC VLR

Short Message Service, Short Message Service,

Mobile Originated Mobile T erminated

SMS

Alfas kop m346 Alfask op m3 46 Alfaskop m34 6

51
Short Message Service (Cell broadcast)

Air A

BTS

BTS

BTS BSC

BTS
Short Message Service,
BTS Cell Broadcast

O&M
Alfask op m346

Alfask op m346

Alfask op m346

52
SMS Architecture

BSS NSS
SMS-
BTS MSC/VLR IWMSC SMSC

BSC TRAU SMS-

GMSC
MS BTS Ext.
EIR HLR AC Appl.

SMS-IWMSC SMS – Interworking MSC

SMS-GMSC SMS – Gateway MSC
SMSC SMS Centre

53
MO Short Message,GSM (Successful Case)

1 5 6
3 SMS-
MS MSC SMSC
9 8 IWMSC 7

2 4

VLR HLR

1: Access Request 4: SendInfoFor-MO-SMS 7: Submit Report

2: Access Request 5: ForwardShortMessage 8: Submit Report
3: Message Transfer 6: Message Transfer 9: Submit Report

54
MT Short Message, (Failure Due to Absent Subscriber)

3 1
MSC/ SMS-
MS 6 8 SMSC
SGSN GMSC

5 4 7 2

VLR HLR

1: Message Transfer 4: SendInfoForMT-SMS 7: SM-Delivery

2: SendRoutingInfo 5: Failure Report ReportStatus
ForShortMsg 6: Failure Report 8: Failure Report
3: ForwardShortMessage
55
Facsimile transmission

Air A

HLR AC EIR
Transparent /
Non Transparent

BSC TC
BTS MSC VLR

IWF

Modems /
Rate Adaptation

56
Data services

Air A

HLR AC EIR
Transparent /
Non Transparent

BSC TC
BTS MSC VLR

IWF

Synchronous / Modems /
Asynchronous Rate Adaptation

57
Supplementary services (1)

• Call Forwarding Unconditional

• Call Forwarding on Mobile Subscriber Busy
• Call Forwarding on No Reply
• Call Forwarding on Mobile Subscriber Not reachable
• Barring Of Outgoing Calls
• Barring Of Outgoing International Calls
• Barring Of all Incoming Calls
• Barring Of Outgoing International Calls Excluding Those Directed to the
Home PLMN Country
• Barring Of all Incoming Calls when roaming outside the Home PLMN

58
Supplementary services (2)

• Call Waiting
• Call Hold
• Multiparty Service
• Explicit Call Transfer
• Calling Number Identification Presentation
• Calling Number Identification Restriction
• Advice of Charge
• Centrex Service
• Operator Determined Barring
• Alternate Line Service (personal or business)

59
 Review Questions to
”GSM Traffic Management“

60
Review

1. The location update procedure is initiated by the:

a) Mobile Station (MS)
b) Mobile services Switching Centre (MSC)
c) Base Station Controller (BSC)
d) Home Location Register (HLR)

2.  The format of the International Mobile Subscriber Identity (IMSI) is:

a) CC + NDC + SN
b) MCC + MNC + MSIN
c) MCC + MNC + LAC
d) Operator-specific 32-bit binary number

61
Review

3. Which of the following cases result in an HLR enquiry?

a) PSTN originated PSTN terminated call

b) Mobile originated PSTN terminated call
c) PSTN originated mobile terminated call
d) None of the above

4.  A location area:
a) is the geographical area under one Base Station
Controller (BSC).
b) is equal to one MSC area.
c) is equal to one cell.
d) is identified by a unique Location Area Identity.

62
Review

• 5. Initiation of the paging process for a mobile station is done by:

a) the MSC over a location area.
b) all Base Transceiver Stations in a location area.
c) a Base Station Controller over one BSC area.
d) a Base Transceiver Station in one cell.
6.  In a mobile terminated call a traffic channel from the NSS in the
terminating side to the called mobile station is reserved when:

a) the MS user answers the ringing of the phone. If GSM Phase 2

b) the B-subscriber accepts the international roaming leg feature „Off Air
Call Set-up“
charging. Is available

c) the MSRN analysis is done and the location area of the

subscriber is known.
d) the mobile station answers the paging signal.
63
Review

• 7. Why is it necessary to check the calling subscriber’s data before allowing the call to
proceed in the originating NSS side?

a) To make sure that s/he has the correct IMSI.

b) To make sure that s/he is provisioned the requested service.
c) To make sure that s/he has the correct TMSI number.
d) To make sure that the NSS knows whom to charge for the
call.

8.  If in a GSM/DCS network the periodic location update timer is set as 10 hours, then a
periodic location update is done:

a) 10 hours after the last periodic location update.

b) 10 hours after the last power on location update.
c) 10 hours after the last generic location update.
d) 10 hours after the last transaction of any kind with the
NSS.
64
Review

9. In an inter-VLR location update, the new VLR asks the old VLR for some
information about the mobile subscriber. The old VLR responds to this
query by providing which of the following information?

a) IMSI and authentication triplets.

b) IMSI, TMSI and subscribed services.
c) IMSI and last location update time.
d) IMSI and HLR address in case of a roaming subscriber.

65
Review

10. If a handover occurs during a call:

a) The new frequency resource always belongs to a cell
other than the current one.
b) A handover number is always required.
c) The initial speech path is not disconnected until a
successful message comes from the mobile station on
the new channel.
d) The subscriber always has to pay extra for the additional
network operation required to maintain his/her call. .

66
Review

11. Charging records can be generated in:

a) the MSC.
b) the HLR.
c) both in the MSC and the HLR.
d) Charging records are not generated in the GSM network.

12. Which network element creates bills for the subscriber?

a) The HLR with information from the MSC.

b) The MSC with information from the Billing Centre.
c) The Billing Centre with information from the MSC.
d) The Billing Centre with information from the
Transcoder.

67
Review

14. The contents of the authentication triplet are:

a) SRES, RAND, A3
b) SRES, RAND, Kc
c) A3, A5, A8
d) RAND, A3, A8
15. What is the result when you use Ki and RAND as inputs through
A8?

a) Encoded speech
b) Signed response
c) Authentication triplet
d) Kc

68
Review

16. What is SRES and Kc used for, respectively?

a) SRES is used for speech encryption and Kc is used for authentication.

b) SRES is used for speech encryption and Kc is used for frame alignment.
c) SRES is used for authentication and Kc is used for speech encryption.
d) Both SRES and Kc are used for speech encryption.

17. Which of the following is not a basic service?

a) SMS-MO
b) Speech, emergency
c) CLIP
d) 14.4 Kbits per second synchronous transparent

69